> Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking?Yes. Argon2i is still resistant against GPU cracking, however with advanced techniques some speedup might be acquired. Argon2d is really GPU unfriendly. The paper explains:
> Should the memory addressing (indexing functions) be input-independent or input-dependent, or hybrid?The first type of schemes, where the memory read location are known in advance, is immediately vulnerable to time-space tradeoff attacks, since an adversary can precompute the missing block by the time it isneeded [5]. In turn, the input-dependent schemes are vulnerable to side-channel attacks [14], as thetiming information allows for much faster password search.
And the recommendation from the paper:
> Argon2 has two variants: Argon2d and Argon2i. Argon2d is faster and uses data-dependingmemory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channeltiming attacks. Argon2i uses data-independent memory access, which is preferred for password hashing andpassword-based key derivation.
FAQs
There are two main versions of Argon2, Argon2i and Argon2d. Argon2i is the safest against side-channel attacks, while Argon2d provides the highest resistance against GPU cracking attacks. See the README for detailed instructions.
What is the difference between Argon2d and Argon2i? ›
Argon2d maximizes resistance to GPU cracking attacks. It accesses the memory array in a password dependent order, which reduces the possibility of time–memory trade-off (TMTO) attacks, but introduces possible side-channel attacks. Argon2i is optimized to resist side-channel attacks.
What is the difference between Argon2 and Yescrypt? ›
- yescrypt currently has less low-level parallelism within processing of a block, yet allows for tuning it later, whereas Argon2 has a fixed and currently commonly excessive amount of such parallelism, which may be extracted to speed up e.g. GPU attacks through use of more computing resources per the same total memory ...
What are Argon2 scrypt bcrypt or PBKDF2 used for? ›
Argon2, scrypt, bcrypt, and PBKDF2 are all algorithms specifically designed for password hashing. Since these algorithms are used for password hashing, they do not primarily serve the purpose of data storage.
What are the different versions of Argon2? ›
Argon2 has 3 variants: Argon2d, Argon2i and Argon2id. Argon2i is optimized for password hashing.
What is the difference between Argon2 and PBKDF2 Luks? ›
With pbkdf2, you can double your iterations, which will double the time you have to wait to unlock your vault, but also double the time an attacker will take to crack your password (if they have your masterpasswordhash). In contrast to this, argon2 is not just compute-bounded but also memory bounded.
Why is Argon2 better? ›
Argon2 is a great memory-hard password hashing algorithm, which makes it good for offline key derivation. But it requires more time, which, for web applications is less ideal. bcrypt can deliver hashing times under 1 second long, but does not include parameters like threads, CPU, or memory hardness.
What is the default Argon2? ›
argon2-cffi's current defaults land with ~50ms somewhere in the middle, but the actual time depends on your hardware. Please note though, that even a verification time of 1 second won't protect you against bad passwords from the “top 10,000 passwords” lists that you can find online.
Is Argon2 Quantum safe? ›
Key-derivation functions (bcrypt, Scrypt, Argon2) are speculated as quantum-safe (only slightly affected by quantum computing).
Does Argon2 use salt? ›
All inputs password, salt, tag, associated data (a little more) are input to Argon2. If you put an empty string to salt, it will be the same function for all passwords.
Argon2 is a cryptographic hashing algorithm specifically used to hash passwords. It provides better protection against password cracking than other hashing algorithms like Bcrypt, Scrypt, and PBKDF2. The Argon2 function takes in the password and outputs the hash of the specified length.
What is the function of Argon2? ›
Argon2 is a password-hashing function that summarizes the state of the art in the design of memory-hard functions and can be used to hash passwords for credential storage, key derivation, or other applications.
Is scrypt more secure than bcrypt? ›
PBKDF2 is simple to implement but is considered to be less secure than more advanced algorithms. Bcrypt is more secure but is more resource-intensive. Scrypt is the most secure but is also the most resource-intensive.
What is the difference between Argon2i and Argon2d? ›
Argon2i is designed to be resistant to side-channel attacks, Argon2d is designed to be resistant to GPU cracking, and Argon2id combines the features of both Argon2i and Argon2d. This means that Argon2id is a good choice for a password hashing algorithm that needs to be resistant to a wide range of attacks.
Is anything better than bcrypt? ›
Scrypt is similar to bcrypt in that it is also designed to be computationally expensive. However, it is also designed to be memory-hard, like Argon2. Scrypt has several parameters that need to be kept in mind, such as the amount of memory to use and the number of iterations to perform.
What is Argon2 parallelism? ›
Parallelism: The number of threads to use. This should be chosen as high as possible to reduce the threat imposed by parallelized hash cracking. Salt Length: The authors of Argon2 recommend this parameter to be 128 bits, but say it can be reduced to 64 bits in the case of space constraints.
